Hi,
I’d like to read/write the hard drive directly in a driver but encountered a problem recently. It’s in Win 10 and the steps are listed below:
1. There are 2 NTFS Hard Drives(HD), namely, the HD0 and HD1. The HD0 has the C: system volume installed, while the HD1 is the disk that we want to access in raw mode .
2. Open the handle to HD1 by ZwCreateFile, it worked;
3. Read the data from HD1 using ZwReadFile, it worked again;
4. Lock the volume by sending FSCTL_LOCK_VOLUME to HD1 disk handle, it worked again;
5. Write the data from HD1 using ZwWriteFile, it failed with 0xc0000022 (ACCESS_DENIED);
6. Try to roll IRP instead of ZwWriteFile call, still got the same error.
The code snippets are following:
RtlInitUnicodeString(&DiskPath, L"\Device\Harddisk1\DR1");
InitializeObjectAttributes(
&ObjAttr,
&DiskPath,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL,
NULL);
Status = ZwCreateFile(
&GRawDiskHandle,
GENERIC_READ |
GENERIC_WRITE,
&ObjAttr,
&Iosb,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
FILE_OPEN,
FILE_NON_DIRECTORY_FILE |
FILE_NO_INTERMEDIATE_BUFFERING |
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);
if(NT_SUCCESS(Status)) {
Status = ZwFsControlFile(
GRawDiskHandle,
NULL,
NULL,
NULL,
&Iosb,
FSCTL_LOCK_VOLUME ,
NULL,
0,
NULL,
0);
if(NT_SUCCESS(Status)) {
Status = ZwWriteFile(
GRawDiskHandle,
NULL,
NULL,
NULL,
&Iosb,
PBuf,
TmpLen,
PBlockAbsOffset,
NULL);
//
// ******ERROR: ACCESS_DENIED returned here******
//
}
}
It's a little weird that the HD1 was locked but I still can't write to the disk.
Any comment will be highly appreciated.
Thanks,
Jason